Merge pull request #1525 from github/update-v2.2.2-927de483f
Merge main into releases/v2
This commit is contained in:
Henry Mercer
GitHub
commit
39d8d7e78f
11 changed files with 561 additions and 319 deletions
|
|
@ -1,5 +1,9 @@
|
|||
# CodeQL Action Changelog
|
||||
|
||||
## 2.2.2 - 06 Feb 2023
|
||||
|
||||
- Fix an issue where customers using the CodeQL Action with the [CodeQL Action sync tool](https://docs.github.com/en/enterprise-server@3.7/admin/code-security/managing-github-advanced-security-for-your-enterprise/configuring-code-scanning-for-your-appliance#configuring-codeql-analysis-on-a-server-without-internet-access) would not be able to obtain the CodeQL tools. [#1517](https://github.com/github/codeql-action/pull/1517)
|
||||
|
||||
## 2.2.1 - 27 Jan 2023
|
||||
|
||||
No user facing changes.
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# CodeQL Action
|
||||
|
||||
This action runs GitHub's industry-leading semantic code analysis engine, CodeQL, against a repository's source code to find security vulnerabilities. It then automatically uploads the results to GitHub so they can be displayed in the repository's security tab. CodeQL runs an extensible set of [queries](https://github.com/github/codeql), which have been developed by the community and the [GitHub Security Lab](https://securitylab.github.com/) to find common vulnerabilities in your code.
|
||||
This action runs GitHub's industry-leading semantic code analysis engine, [CodeQL](https://codeql.github.com/), against a repository's source code to find security vulnerabilities. It then automatically uploads the results to GitHub so they can be displayed in the repository's security tab. CodeQL runs an extensible set of [queries](https://github.com/github/codeql), which have been developed by the community and the [GitHub Security Lab](https://securitylab.github.com/) to find common vulnerabilities in your code.
|
||||
|
||||
For a list of recent changes, see the CodeQL Action's [changelog](CHANGELOG.md).
|
||||
|
||||
|
|
|
|||
92
lib/codeql.test.js
generated
92
lib/codeql.test.js
generated
|
|
@ -97,7 +97,7 @@ ava_1.default.beforeEach(() => {
|
|||
* @returns the download URL for the bundle. This can be passed to the tools parameter of
|
||||
* `codeql.setupCodeQL`.
|
||||
*/
|
||||
function mockDownloadApi({ apiDetails = sampleApiDetails, isPinned, tagName, }) {
|
||||
function mockDownloadApi({ apiDetails = sampleApiDetails, isPinned, repo = "github/codeql-action", platformSpecific = true, tagName, }) {
|
||||
const platform = process.platform === "win32"
|
||||
? "win64"
|
||||
: process.platform === "linux"
|
||||
|
|
@ -105,7 +105,7 @@ function mockDownloadApi({ apiDetails = sampleApiDetails, isPinned, tagName, })
|
|||
: "osx64";
|
||||
const baseUrl = apiDetails?.url ?? "https://example.com";
|
||||
const relativeUrl = apiDetails
|
||||
? `/github/codeql-action/releases/download/${tagName}/codeql-bundle-${platform}.tar.gz`
|
||||
? `/${repo}/releases/download/${tagName}/codeql-bundle${platformSpecific ? `-${platform}` : ""}.tar.gz`
|
||||
: `/download/${tagName}/codeql-bundle.tar.gz`;
|
||||
(0, nock_1.default)(baseUrl)
|
||||
.get(relativeUrl)
|
||||
|
|
@ -327,41 +327,73 @@ for (const variant of [util.GitHubVariant.GHAE, util.GitHubVariant.GHES]) {
|
|||
t.is(cachedVersions.length, 2);
|
||||
});
|
||||
});
|
||||
(0, ava_1.default)("download codeql bundle from github ae endpoint", async (t) => {
|
||||
for (const isBundleVersionInUrl of [true, false]) {
|
||||
const inclusionString = isBundleVersionInUrl
|
||||
? "includes"
|
||||
: "does not include";
|
||||
(0, ava_1.default)(`download codeql bundle from github ae endpoint (URL ${inclusionString} bundle version)`, async (t) => {
|
||||
await util.withTmpDir(async (tmpDir) => {
|
||||
(0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
|
||||
const bundleAssetID = 10;
|
||||
const platform = process.platform === "win32"
|
||||
? "win64"
|
||||
: process.platform === "linux"
|
||||
? "linux64"
|
||||
: "osx64";
|
||||
const codeQLBundleName = `codeql-bundle-${platform}.tar.gz`;
|
||||
const eventualDownloadUrl = isBundleVersionInUrl
|
||||
? `https://example.githubenterprise.com/github/codeql-action/releases/download/${defaults.bundleVersion}/${codeQLBundleName}`
|
||||
: `https://example.githubenterprise.com/api/v3/repos/github/codeql-action/releases/assets/${bundleAssetID}`;
|
||||
(0, nock_1.default)("https://example.githubenterprise.com")
|
||||
.get(`/api/v3/enterprise/code-scanning/codeql-bundle/find/${defaults.bundleVersion}`)
|
||||
.reply(200, {
|
||||
assets: { [codeQLBundleName]: bundleAssetID },
|
||||
});
|
||||
(0, nock_1.default)("https://example.githubenterprise.com")
|
||||
.get(`/api/v3/enterprise/code-scanning/codeql-bundle/download/${bundleAssetID}`)
|
||||
.reply(200, {
|
||||
url: eventualDownloadUrl,
|
||||
});
|
||||
(0, nock_1.default)("https://example.githubenterprise.com")
|
||||
.get(eventualDownloadUrl.replace("https://example.githubenterprise.com", ""))
|
||||
.replyWithFile(200, path_1.default.join(__dirname, `/../src/testdata/codeql-bundle-pinned.tar.gz`));
|
||||
mockApiDetails(sampleGHAEApiDetails);
|
||||
sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
|
||||
process.env["GITHUB_ACTION_REPOSITORY"] = "github/codeql-action";
|
||||
const result = await codeql.setupCodeQL(undefined, sampleGHAEApiDetails, tmpDir, util.GitHubVariant.GHAE, false, {
|
||||
cliVersion: defaults.cliVersion,
|
||||
tagName: defaults.bundleVersion,
|
||||
variant: util.GitHubVariant.GHAE,
|
||||
}, (0, logging_1.getRunnerLogger)(true), false);
|
||||
t.is(result.toolsSource, init_1.ToolsSource.Download);
|
||||
t.assert(Number.isInteger(result.toolsDownloadDurationMs));
|
||||
const cachedVersions = toolcache.findAllVersions("CodeQL");
|
||||
t.is(cachedVersions.length, 1);
|
||||
});
|
||||
});
|
||||
}
|
||||
(0, ava_1.default)("bundle URL from another repo is cached as 0.0.0-bundleVersion", async (t) => {
|
||||
await util.withTmpDir(async (tmpDir) => {
|
||||
(0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
|
||||
const bundleAssetID = 10;
|
||||
const platform = process.platform === "win32"
|
||||
? "win64"
|
||||
: process.platform === "linux"
|
||||
? "linux64"
|
||||
: "osx64";
|
||||
const codeQLBundleName = `codeql-bundle-${platform}.tar.gz`;
|
||||
(0, nock_1.default)("https://example.githubenterprise.com")
|
||||
.get(`/api/v3/enterprise/code-scanning/codeql-bundle/find/${defaults.bundleVersion}`)
|
||||
.reply(200, {
|
||||
assets: { [codeQLBundleName]: bundleAssetID },
|
||||
mockApiDetails(sampleApiDetails);
|
||||
sinon.stub(actionsUtil, "isRunningLocalAction").returns(true);
|
||||
const releasesApiMock = mockReleaseApi({
|
||||
assetNames: ["cli-version-2.12.2.txt"],
|
||||
tagName: "codeql-bundle-20230203",
|
||||
});
|
||||
(0, nock_1.default)("https://example.githubenterprise.com")
|
||||
.get(`/api/v3/enterprise/code-scanning/codeql-bundle/download/${bundleAssetID}`)
|
||||
.reply(200, {
|
||||
url: `https://example.githubenterprise.com/github/codeql-action/releases/download/${defaults.bundleVersion}/${codeQLBundleName}`,
|
||||
mockDownloadApi({
|
||||
repo: "dsp-testing/codeql-cli-nightlies",
|
||||
platformSpecific: false,
|
||||
tagName: "codeql-bundle-20230203",
|
||||
});
|
||||
(0, nock_1.default)("https://example.githubenterprise.com")
|
||||
.get(`/github/codeql-action/releases/download/${defaults.bundleVersion}/${codeQLBundleName}`)
|
||||
.replyWithFile(200, path_1.default.join(__dirname, `/../src/testdata/codeql-bundle-pinned.tar.gz`));
|
||||
mockApiDetails(sampleGHAEApiDetails);
|
||||
sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
|
||||
process.env["GITHUB_ACTION_REPOSITORY"] = "github/codeql-action";
|
||||
const result = await codeql.setupCodeQL(undefined, sampleGHAEApiDetails, tmpDir, util.GitHubVariant.GHAE, false, {
|
||||
cliVersion: defaults.cliVersion,
|
||||
tagName: defaults.bundleVersion,
|
||||
variant: util.GitHubVariant.GHAE,
|
||||
}, (0, logging_1.getRunnerLogger)(true), false);
|
||||
const result = await codeql.setupCodeQL("https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/codeql-bundle-20230203/codeql-bundle.tar.gz", sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, false, SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
|
||||
t.is(result.toolsVersion, "0.0.0-20230203");
|
||||
t.is(result.toolsSource, init_1.ToolsSource.Download);
|
||||
t.assert(Number.isInteger(result.toolsDownloadDurationMs));
|
||||
t.true(Number.isInteger(result.toolsDownloadDurationMs));
|
||||
const cachedVersions = toolcache.findAllVersions("CodeQL");
|
||||
t.is(cachedVersions.length, 1);
|
||||
t.is(cachedVersions[0], "0.0.0-20230203");
|
||||
t.false(releasesApiMock.isDone());
|
||||
});
|
||||
});
|
||||
(0, ava_1.default)("getExtraOptions works for explicit paths", (t) => {
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
263
lib/setup-codeql.js
generated
263
lib/setup-codeql.js
generated
|
|
@ -26,7 +26,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
|
|||
return (mod && mod.__esModule) ? mod : { "default": mod };
|
||||
};
|
||||
Object.defineProperty(exports, "__esModule", { value: true });
|
||||
exports.setupCodeQLBundle = exports.getCodeQLURLVersion = exports.downloadCodeQL = exports.getCodeQLSource = exports.convertToSemVer = exports.getBundleVersionFromUrl = exports.tryFindCliVersionDotcomOnly = exports.findCodeQLBundleTagDotcomOnly = exports.getCodeQLActionRepository = exports.CODEQL_DEFAULT_ACTION_REPOSITORY = void 0;
|
||||
exports.setupCodeQLBundle = exports.getCodeQLURLVersion = exports.downloadCodeQL = exports.tryGetFallbackToolcacheVersion = exports.getCodeQLSource = exports.convertToSemVer = exports.tryGetBundleVersionFromUrl = exports.tryFindCliVersionDotcomOnly = exports.findCodeQLBundleTagDotcomOnly = exports.getCodeQLActionRepository = exports.CODEQL_DEFAULT_ACTION_REPOSITORY = void 0;
|
||||
const fs = __importStar(require("fs"));
|
||||
const path = __importStar(require("path"));
|
||||
const perf_hooks_1 = require("perf_hooks");
|
||||
|
|
@ -211,21 +211,30 @@ async function getCodeQLBundleDownloadURL(tagName, apiDetails, variant, logger)
|
|||
}
|
||||
return `https://github.com/${exports.CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${codeQLBundleName}`;
|
||||
}
|
||||
function getBundleVersionFromTagName(tagName) {
|
||||
function tryGetBundleVersionFromTagName(tagName, logger) {
|
||||
const match = tagName.match(/^codeql-bundle-(.*)$/);
|
||||
if (match === null || match.length < 2) {
|
||||
throw new Error(`Malformed bundle tag name: ${tagName}. Bundle version could not be inferred`);
|
||||
logger.debug(`Could not determine bundle version from tag ${tagName}.`);
|
||||
return undefined;
|
||||
}
|
||||
return match[1];
|
||||
}
|
||||
function getBundleVersionFromUrl(url) {
|
||||
function tryGetTagNameFromUrl(url, logger) {
|
||||
const match = url.match(/\/(codeql-bundle-.*)\//);
|
||||
if (match === null || match.length < 2) {
|
||||
throw new Error(`Malformed tools url: ${url}. Bundle version could not be inferred`);
|
||||
logger.debug(`Could not determine tag name for URL ${url}.`);
|
||||
return undefined;
|
||||
}
|
||||
return getBundleVersionFromTagName(match[1]);
|
||||
return match[1];
|
||||
}
|
||||
exports.getBundleVersionFromUrl = getBundleVersionFromUrl;
|
||||
function tryGetBundleVersionFromUrl(url, logger) {
|
||||
const tagName = tryGetTagNameFromUrl(url, logger);
|
||||
if (tagName === undefined) {
|
||||
return undefined;
|
||||
}
|
||||
return tryGetBundleVersionFromTagName(tagName, logger);
|
||||
}
|
||||
exports.tryGetBundleVersionFromUrl = tryGetBundleVersionFromUrl;
|
||||
function convertToSemVer(version, logger) {
|
||||
if (!semver.valid(version)) {
|
||||
logger.debug(`Bundle version ${version} is not in SemVer format. Will treat it as pre-release 0.0.0-${version}.`);
|
||||
|
|
@ -238,18 +247,10 @@ function convertToSemVer(version, logger) {
|
|||
return s;
|
||||
}
|
||||
exports.convertToSemVer = convertToSemVer;
|
||||
async function getOrFindBundleTagName(version, logger) {
|
||||
if (version.variant === util.GitHubVariant.DOTCOM) {
|
||||
return await findCodeQLBundleTagDotcomOnly(version.cliVersion, logger);
|
||||
}
|
||||
else {
|
||||
return version.tagName;
|
||||
}
|
||||
}
|
||||
/**
|
||||
* Look for a version of the CodeQL tools in the cache which could override the requested CLI version.
|
||||
*/
|
||||
async function findOverridingToolsInCache(requestedCliVersion, logger) {
|
||||
async function findOverridingToolsInCache(humanReadableVersion, logger) {
|
||||
const candidates = toolcache
|
||||
.findAllVersions("CodeQL")
|
||||
.filter(util_1.isGoodVersion)
|
||||
|
|
@ -260,7 +261,7 @@ async function findOverridingToolsInCache(requestedCliVersion, logger) {
|
|||
.filter(({ folder }) => fs.existsSync(path.join(folder, "pinned-version")));
|
||||
if (candidates.length === 1) {
|
||||
const candidate = candidates[0];
|
||||
logger.debug(`CodeQL tools version ${candidate.version} in toolcache overriding version ${requestedCliVersion}.`);
|
||||
logger.debug(`CodeQL tools version ${candidate.version} in toolcache overriding version ${humanReadableVersion}.`);
|
||||
return {
|
||||
codeqlFolder: candidate.folder,
|
||||
sourceType: "toolcache",
|
||||
|
|
@ -284,7 +285,8 @@ async function getCodeQLSource(toolsInput, bypassToolcache, defaultCliVersion, a
|
|||
toolsVersion: "local",
|
||||
};
|
||||
}
|
||||
const forceLatestReason =
|
||||
/** The reason why the tools shipped with the Action have been forced. */
|
||||
const forceShippedToolsReason =
|
||||
// We use the special value of 'latest' to prioritize the version in the
|
||||
// defaults over any pinned cached version.
|
||||
toolsInput === "latest"
|
||||
|
|
@ -296,112 +298,160 @@ async function getCodeQLSource(toolsInput, bypassToolcache, defaultCliVersion, a
|
|||
toolsInput === undefined && bypassToolcache
|
||||
? "a specific version of the CodeQL tools was not requested and the bypass toolcache feature is enabled"
|
||||
: undefined;
|
||||
const forceLatest = forceLatestReason !== undefined;
|
||||
if (forceLatest) {
|
||||
logger.debug(`Forcing the latest version of the CodeQL tools since ${forceLatestReason}.`);
|
||||
/** Whether the tools shipped with the Action, i.e. those in `defaults.json`, have been forced. */
|
||||
const forceShippedTools = forceShippedToolsReason !== undefined;
|
||||
if (forceShippedTools) {
|
||||
logger.info("Overriding the version of the CodeQL tools by the version shipped with the Action since " +
|
||||
`${forceShippedToolsReason}.`);
|
||||
}
|
||||
/** CLI version number, for example 2.12.1. */
|
||||
let cliVersion;
|
||||
/** Tag name of the CodeQL bundle, for example `codeql-bundle-20230120`. */
|
||||
let tagName;
|
||||
/**
|
||||
* The requested version is:
|
||||
* URL of the CodeQL bundle.
|
||||
*
|
||||
* 1. The one in `defaults.json`, if forceLatest is true.
|
||||
* 2. The version specified by the tools input URL, if one was provided.
|
||||
* 3. The default CLI version, otherwise.
|
||||
|
||||
* We include a `variant` property to let us verify using the type system that
|
||||
* `tagName` is only undefined when the variant is Dotcom. This lets us ensure
|
||||
* that we can always compute `tagName`, either by using the existing tag name
|
||||
* on enterprise instances, or calling `findCodeQLBundleTagDotcomOnly` on
|
||||
* Dotcom.
|
||||
* This does not always include a tag name.
|
||||
*/
|
||||
const requestedVersion = forceLatest
|
||||
? // case 1
|
||||
{
|
||||
cliVersion: defaults.cliVersion,
|
||||
syntheticCliVersion: defaults.cliVersion,
|
||||
tagName: defaults.bundleVersion,
|
||||
variant,
|
||||
}
|
||||
: toolsInput !== undefined
|
||||
? // case 2
|
||||
{
|
||||
syntheticCliVersion: convertToSemVer(getBundleVersionFromUrl(toolsInput), logger),
|
||||
tagName: `codeql-bundle-${getBundleVersionFromUrl(toolsInput)}`,
|
||||
url: toolsInput,
|
||||
variant,
|
||||
}
|
||||
: // case 3
|
||||
{
|
||||
...defaultCliVersion,
|
||||
syntheticCliVersion: defaultCliVersion.cliVersion,
|
||||
};
|
||||
// If we find the specified version, we always use that.
|
||||
let codeqlFolder = toolcache.find("CodeQL", requestedVersion.syntheticCliVersion);
|
||||
let tagName = requestedVersion["tagName"];
|
||||
if (!codeqlFolder) {
|
||||
logger.debug("Didn't find a version of the CodeQL tools in the toolcache with a version number " +
|
||||
`exactly matching ${requestedVersion.syntheticCliVersion}.`);
|
||||
if (requestedVersion.cliVersion) {
|
||||
let url;
|
||||
if (forceShippedTools) {
|
||||
cliVersion = defaults.cliVersion;
|
||||
tagName = defaults.bundleVersion;
|
||||
}
|
||||
else if (toolsInput !== undefined) {
|
||||
// If a tools URL was provided, then use that.
|
||||
tagName = tryGetTagNameFromUrl(toolsInput, logger);
|
||||
url = toolsInput;
|
||||
}
|
||||
else {
|
||||
// Otherwise, use the default CLI version passed in.
|
||||
cliVersion = defaultCliVersion.cliVersion;
|
||||
tagName = defaultCliVersion["tagName"];
|
||||
}
|
||||
const bundleVersion = tagName && tryGetBundleVersionFromTagName(tagName, logger);
|
||||
const humanReadableVersion = cliVersion ??
|
||||
(bundleVersion && convertToSemVer(bundleVersion, logger)) ??
|
||||
tagName ??
|
||||
url ??
|
||||
"unknown";
|
||||
logger.debug("Attempting to obtain CodeQL tools. " +
|
||||
`CLI version: ${cliVersion ?? "unknown"}, ` +
|
||||
`bundle tag name: ${tagName ?? "unknown"}, ` +
|
||||
`URL: ${url ?? "unspecified"}.`);
|
||||
let codeqlFolder;
|
||||
if (cliVersion) {
|
||||
// If we find the specified CLI version, we always use that.
|
||||
codeqlFolder = toolcache.find("CodeQL", cliVersion);
|
||||
// Fall back to matching `x.y.z-<tagName>`.
|
||||
if (!codeqlFolder) {
|
||||
logger.debug("Didn't find a version of the CodeQL tools in the toolcache with a version number " +
|
||||
`exactly matching ${cliVersion}.`);
|
||||
const allVersions = toolcache.findAllVersions("CodeQL");
|
||||
logger.debug(`Found the following versions of the CodeQL tools in the toolcache: ${JSON.stringify(allVersions)}.`);
|
||||
// If there is exactly one version of the CodeQL tools in the toolcache, and that version is
|
||||
// the form `x.y.z-<tagName>`, then use it.
|
||||
const candidateVersions = allVersions.filter((version) => version.startsWith(`${requestedVersion.cliVersion}-`));
|
||||
const candidateVersions = allVersions.filter((version) => version.startsWith(`${cliVersion}-`));
|
||||
if (candidateVersions.length === 1) {
|
||||
logger.debug("Exactly one candidate version found, using that.");
|
||||
logger.debug(`Exactly one version of the CodeQL tools starting with ${cliVersion} found in the ` +
|
||||
"toolcache, using that.");
|
||||
codeqlFolder = toolcache.find("CodeQL", candidateVersions[0]);
|
||||
}
|
||||
else if (candidateVersions.length === 0) {
|
||||
logger.debug(`Didn't find any versions of the CodeQL tools starting with ${cliVersion} ` +
|
||||
`in the toolcache. Trying next fallback method.`);
|
||||
}
|
||||
else {
|
||||
logger.debug("Did not find exactly one version of the CodeQL tools starting with the requested version.");
|
||||
logger.warning(`Found ${candidateVersions.length} versions of the CodeQL tools starting with ` +
|
||||
`${cliVersion} in the toolcache, but at most one was expected.`);
|
||||
logger.debug("Trying next fallback method.");
|
||||
}
|
||||
}
|
||||
}
|
||||
if (!codeqlFolder && requestedVersion.cliVersion) {
|
||||
// Fall back to accepting a `0.0.0-<bundleVersion>` version if we didn't find the
|
||||
// `x.y.z` version. This is to support old versions of the toolcache.
|
||||
//
|
||||
// If we are on Dotcom, we will make an HTTP request to the Releases API here
|
||||
// to find the tag name for the requested version.
|
||||
tagName =
|
||||
tagName || (await getOrFindBundleTagName(requestedVersion, logger));
|
||||
const fallbackVersion = convertToSemVer(getBundleVersionFromTagName(tagName), logger);
|
||||
logger.debug(`Computed a fallback toolcache version number of ${fallbackVersion} for CodeQL tools version ` +
|
||||
`${requestedVersion.cliVersion}.`);
|
||||
codeqlFolder = toolcache.find("CodeQL", fallbackVersion);
|
||||
// Fall back to matching `0.0.0-<bundleVersion>`.
|
||||
if (!codeqlFolder && (cliVersion || tagName)) {
|
||||
if (cliVersion || tagName) {
|
||||
const fallbackVersion = await tryGetFallbackToolcacheVersion(cliVersion, tagName, variant, logger);
|
||||
if (fallbackVersion) {
|
||||
codeqlFolder = toolcache.find("CodeQL", fallbackVersion);
|
||||
}
|
||||
else {
|
||||
logger.debug("Could not determine a fallback toolcache version number for CodeQL tools version " +
|
||||
`${humanReadableVersion}.`);
|
||||
}
|
||||
}
|
||||
else {
|
||||
logger.debug("Both the CLI version and the bundle version are unknown, so we will not be able to find " +
|
||||
"the requested version of the CodeQL tools in the toolcache.");
|
||||
}
|
||||
}
|
||||
if (codeqlFolder) {
|
||||
logger.info(`Found CodeQL tools version ${humanReadableVersion} in the toolcache.`);
|
||||
}
|
||||
else {
|
||||
logger.info(`Did not find CodeQL tools version ${humanReadableVersion} in the toolcache.`);
|
||||
}
|
||||
if (codeqlFolder) {
|
||||
return {
|
||||
codeqlFolder,
|
||||
sourceType: "toolcache",
|
||||
toolsVersion: requestedVersion.syntheticCliVersion,
|
||||
toolsVersion: cliVersion ?? humanReadableVersion,
|
||||
};
|
||||
}
|
||||
logger.debug(`Did not find CodeQL tools version ${requestedVersion.syntheticCliVersion} in the toolcache.`);
|
||||
// If we don't find the requested version on Enterprise, we may allow a
|
||||
// different version to save download time if the version hasn't been
|
||||
// specified explicitly (in which case we always honor it).
|
||||
if (variant !== util.GitHubVariant.DOTCOM && !forceLatest && !toolsInput) {
|
||||
const result = await findOverridingToolsInCache(requestedVersion.syntheticCliVersion, logger);
|
||||
if (variant !== util.GitHubVariant.DOTCOM &&
|
||||
!forceShippedTools &&
|
||||
!toolsInput) {
|
||||
const result = await findOverridingToolsInCache(humanReadableVersion, logger);
|
||||
if (result !== undefined) {
|
||||
return result;
|
||||
}
|
||||
}
|
||||
if (!url) {
|
||||
if (!tagName && cliVersion && variant === util.GitHubVariant.DOTCOM) {
|
||||
tagName = await findCodeQLBundleTagDotcomOnly(cliVersion, logger);
|
||||
}
|
||||
else if (!tagName) {
|
||||
throw new Error(`Could not obtain the requested version (${humanReadableVersion}) of the CodeQL tools ` +
|
||||
"since we could not compute the tag name.");
|
||||
}
|
||||
url = await getCodeQLBundleDownloadURL(tagName, apiDetails, variant, logger);
|
||||
}
|
||||
return {
|
||||
cliVersion: requestedVersion.cliVersion || undefined,
|
||||
codeqlURL: requestedVersion["url"] ||
|
||||
(await getCodeQLBundleDownloadURL(tagName ||
|
||||
// The check on `requestedVersion.tagName` is redundant but lets us
|
||||
// use the property that if we don't know `requestedVersion.tagName`,
|
||||
// then we must know `requestedVersion.cliVersion`. This property is
|
||||
// required by the type of `getOrFindBundleTagName`.
|
||||
(requestedVersion.tagName !== undefined
|
||||
? requestedVersion.tagName
|
||||
: await getOrFindBundleTagName(requestedVersion, logger)), apiDetails, variant, logger)),
|
||||
bundleVersion: tagName && tryGetBundleVersionFromTagName(tagName, logger),
|
||||
cliVersion,
|
||||
codeqlURL: url,
|
||||
sourceType: "download",
|
||||
toolsVersion: requestedVersion.syntheticCliVersion,
|
||||
toolsVersion: cliVersion ?? humanReadableVersion,
|
||||
};
|
||||
}
|
||||
exports.getCodeQLSource = getCodeQLSource;
|
||||
async function downloadCodeQL(codeqlURL, maybeCliVersion, apiDetails, variant, tempDir, logger) {
|
||||
/**
|
||||
* Gets a fallback version number to use when looking for CodeQL in the toolcache if we didn't find
|
||||
* the `x.y.z` version. This is to support old versions of the toolcache.
|
||||
*/
|
||||
async function tryGetFallbackToolcacheVersion(cliVersion, tagName, variant, logger) {
|
||||
//
|
||||
// If we are on Dotcom, we will make an HTTP request to the Releases API here
|
||||
// to find the tag name for the requested version.
|
||||
if (cliVersion && !tagName && variant === util.GitHubVariant.DOTCOM) {
|
||||
tagName = await findCodeQLBundleTagDotcomOnly(cliVersion, logger);
|
||||
}
|
||||
if (!tagName) {
|
||||
return undefined;
|
||||
}
|
||||
const bundleVersion = tryGetBundleVersionFromTagName(tagName, logger);
|
||||
if (!bundleVersion) {
|
||||
return undefined;
|
||||
}
|
||||
const fallbackVersion = convertToSemVer(bundleVersion, logger);
|
||||
logger.debug(`Computed a fallback toolcache version number of ${fallbackVersion} for CodeQL version ` +
|
||||
`${cliVersion ?? tagName}.`);
|
||||
return fallbackVersion;
|
||||
}
|
||||
exports.tryGetFallbackToolcacheVersion = tryGetFallbackToolcacheVersion;
|
||||
async function downloadCodeQL(codeqlURL, maybeBundleVersion, maybeCliVersion, apiDetails, variant, tempDir, logger) {
|
||||
const parsedCodeQLURL = new URL(codeqlURL);
|
||||
const searchParams = new URLSearchParams(parsedCodeQLURL.search);
|
||||
const headers = {
|
||||
|
|
@ -411,12 +461,13 @@ async function downloadCodeQL(codeqlURL, maybeCliVersion, apiDetails, variant, t
|
|||
// from the same GitHub instance the Action is running on.
|
||||
// This avoids leaking Enterprise tokens to dotcom.
|
||||
// We also don't want to send an authorization header if there's already a token provided in the URL.
|
||||
let authorization = undefined;
|
||||
if (searchParams.has("token")) {
|
||||
logger.debug("CodeQL tools URL contains an authorization token.");
|
||||
}
|
||||
else if (codeqlURL.startsWith(`${apiDetails.url}/`)) {
|
||||
logger.debug("Providing an authorization token to download CodeQL tools.");
|
||||
headers.authorization = `token ${apiDetails.auth}`;
|
||||
authorization = `token ${apiDetails.auth}`;
|
||||
}
|
||||
else {
|
||||
logger.debug("Downloading CodeQL tools without an authorization token.");
|
||||
|
|
@ -425,16 +476,26 @@ async function downloadCodeQL(codeqlURL, maybeCliVersion, apiDetails, variant, t
|
|||
const dest = path.join(tempDir, (0, uuid_1.v4)());
|
||||
const finalHeaders = Object.assign({ "User-Agent": "CodeQL Action" }, headers);
|
||||
const toolsDownloadStart = perf_hooks_1.performance.now();
|
||||
const codeqlPath = await toolcache.downloadTool(codeqlURL, dest, undefined, finalHeaders);
|
||||
const codeqlPath = await toolcache.downloadTool(codeqlURL, dest, authorization, finalHeaders);
|
||||
const toolsDownloadDurationMs = Math.round(perf_hooks_1.performance.now() - toolsDownloadStart);
|
||||
logger.debug(`CodeQL bundle download to ${codeqlPath} complete.`);
|
||||
const codeqlExtracted = await toolcache.extractTar(codeqlPath);
|
||||
const bundleVersion = getBundleVersionFromUrl(codeqlURL);
|
||||
const bundleVersion = maybeBundleVersion ?? tryGetBundleVersionFromUrl(codeqlURL, logger);
|
||||
if (bundleVersion === undefined) {
|
||||
logger.debug("Could not cache CodeQL tools because we could not determine the bundle version from the " +
|
||||
`URL ${codeqlURL}.`);
|
||||
return {
|
||||
toolsVersion: maybeCliVersion ?? "unknown",
|
||||
codeqlFolder: codeqlExtracted,
|
||||
toolsDownloadDurationMs,
|
||||
};
|
||||
}
|
||||
// Try to compute the CLI version for this bundle
|
||||
const cliVersion = maybeCliVersion ||
|
||||
(variant === util.GitHubVariant.DOTCOM &&
|
||||
(await tryFindCliVersionDotcomOnly(`codeql-bundle-${bundleVersion}`, logger))) ||
|
||||
undefined;
|
||||
if (maybeCliVersion === undefined &&
|
||||
variant === util.GitHubVariant.DOTCOM &&
|
||||
codeqlURL.includes(`/${exports.CODEQL_DEFAULT_ACTION_REPOSITORY}/`)) {
|
||||
maybeCliVersion = await tryFindCliVersionDotcomOnly(`codeql-bundle-${bundleVersion}`, logger);
|
||||
}
|
||||
// Include both the CLI version and the bundle version in the toolcache version number. That way
|
||||
// if the user requests the same URL again, we can get it from the cache without having to call
|
||||
// any of the Releases API.
|
||||
|
|
@ -444,11 +505,11 @@ async function downloadCodeQL(codeqlURL, maybeCliVersion, apiDetails, variant, t
|
|||
// CLI release. In principle, it should be enough to just check that the CLI version isn't a
|
||||
// pre-release, but the version numbers of CodeQL nightlies have the format `x.y.z+<timestamp>`,
|
||||
// and we don't want these nightlies to override stable CLI versions in the toolcache.
|
||||
const toolcacheVersion = cliVersion && cliVersion.match(/^[0-9]+\.[0-9]+\.[0-9]+$/)
|
||||
? `${cliVersion}-${bundleVersion}`
|
||||
const toolcacheVersion = maybeCliVersion?.match(/^[0-9]+\.[0-9]+\.[0-9]+$/)
|
||||
? `${maybeCliVersion}-${bundleVersion}`
|
||||
: convertToSemVer(bundleVersion, logger);
|
||||
return {
|
||||
toolsVersion: cliVersion || toolcacheVersion,
|
||||
toolsVersion: maybeCliVersion ?? toolcacheVersion,
|
||||
codeqlFolder: await toolcache.cacheDir(codeqlExtracted, "CodeQL", toolcacheVersion),
|
||||
toolsDownloadDurationMs,
|
||||
};
|
||||
|
|
@ -493,7 +554,7 @@ async function setupCodeQLBundle(toolsInput, apiDetails, tempDir, variant, bypas
|
|||
toolsSource = init_1.ToolsSource.Toolcache;
|
||||
break;
|
||||
case "download": {
|
||||
const result = await downloadCodeQL(source.codeqlURL, source.cliVersion, apiDetails, variant, tempDir, logger);
|
||||
const result = await downloadCodeQL(source.codeqlURL, source.bundleVersion, source.cliVersion, apiDetails, variant, tempDir, logger);
|
||||
toolsVersion = result.toolsVersion;
|
||||
codeqlFolder = result.codeqlFolder;
|
||||
toolsDownloadDurationMs = result.toolsDownloadDurationMs;
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
2
node_modules/.package-lock.json
generated
vendored
2
node_modules/.package-lock.json
generated
vendored
|
|
@ -1,6 +1,6 @@
|
|||
{
|
||||
"name": "codeql",
|
||||
"version": "2.2.1",
|
||||
"version": "2.2.2",
|
||||
"lockfileVersion": 3,
|
||||
"requires": true,
|
||||
"packages": {
|
||||
|
|
|
|||
4
package-lock.json
generated
4
package-lock.json
generated
|
|
@ -1,12 +1,12 @@
|
|||
{
|
||||
"name": "codeql",
|
||||
"version": "2.2.1",
|
||||
"version": "2.2.2",
|
||||
"lockfileVersion": 3,
|
||||
"requires": true,
|
||||
"packages": {
|
||||
"": {
|
||||
"name": "codeql",
|
||||
"version": "2.2.1",
|
||||
"version": "2.2.2",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@actions/artifact": "^1.1.0",
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{
|
||||
"name": "codeql",
|
||||
"version": "2.2.1",
|
||||
"version": "2.2.2",
|
||||
"private": true,
|
||||
"description": "CodeQL action",
|
||||
"scripts": {
|
||||
|
|
|
|||
|
|
@ -87,10 +87,14 @@ test.beforeEach(() => {
|
|||
function mockDownloadApi({
|
||||
apiDetails = sampleApiDetails,
|
||||
isPinned,
|
||||
repo = "github/codeql-action",
|
||||
platformSpecific = true,
|
||||
tagName,
|
||||
}: {
|
||||
apiDetails?: GitHubApiDetails;
|
||||
isPinned?: boolean;
|
||||
repo?: string;
|
||||
platformSpecific?: boolean;
|
||||
tagName: string;
|
||||
}): string {
|
||||
const platform =
|
||||
|
|
@ -102,7 +106,9 @@ function mockDownloadApi({
|
|||
|
||||
const baseUrl = apiDetails?.url ?? "https://example.com";
|
||||
const relativeUrl = apiDetails
|
||||
? `/github/codeql-action/releases/download/${tagName}/codeql-bundle-${platform}.tar.gz`
|
||||
? `/${repo}/releases/download/${tagName}/codeql-bundle${
|
||||
platformSpecific ? `-${platform}` : ""
|
||||
}.tar.gz`
|
||||
: `/download/${tagName}/codeql-bundle.tar.gz`;
|
||||
|
||||
nock(baseUrl)
|
||||
|
|
@ -468,69 +474,120 @@ test('downloads bundle if "latest" tools specified but not cached', async (t) =>
|
|||
});
|
||||
});
|
||||
|
||||
test("download codeql bundle from github ae endpoint", async (t) => {
|
||||
for (const isBundleVersionInUrl of [true, false]) {
|
||||
const inclusionString = isBundleVersionInUrl
|
||||
? "includes"
|
||||
: "does not include";
|
||||
test(`download codeql bundle from github ae endpoint (URL ${inclusionString} bundle version)`, async (t) => {
|
||||
await util.withTmpDir(async (tmpDir) => {
|
||||
setupActionsVars(tmpDir, tmpDir);
|
||||
|
||||
const bundleAssetID = 10;
|
||||
|
||||
const platform =
|
||||
process.platform === "win32"
|
||||
? "win64"
|
||||
: process.platform === "linux"
|
||||
? "linux64"
|
||||
: "osx64";
|
||||
const codeQLBundleName = `codeql-bundle-${platform}.tar.gz`;
|
||||
|
||||
const eventualDownloadUrl = isBundleVersionInUrl
|
||||
? `https://example.githubenterprise.com/github/codeql-action/releases/download/${defaults.bundleVersion}/${codeQLBundleName}`
|
||||
: `https://example.githubenterprise.com/api/v3/repos/github/codeql-action/releases/assets/${bundleAssetID}`;
|
||||
|
||||
nock("https://example.githubenterprise.com")
|
||||
.get(
|
||||
`/api/v3/enterprise/code-scanning/codeql-bundle/find/${defaults.bundleVersion}`
|
||||
)
|
||||
.reply(200, {
|
||||
assets: { [codeQLBundleName]: bundleAssetID },
|
||||
});
|
||||
|
||||
nock("https://example.githubenterprise.com")
|
||||
.get(
|
||||
`/api/v3/enterprise/code-scanning/codeql-bundle/download/${bundleAssetID}`
|
||||
)
|
||||
.reply(200, {
|
||||
url: eventualDownloadUrl,
|
||||
});
|
||||
|
||||
nock("https://example.githubenterprise.com")
|
||||
.get(
|
||||
eventualDownloadUrl.replace(
|
||||
"https://example.githubenterprise.com",
|
||||
""
|
||||
)
|
||||
)
|
||||
.replyWithFile(
|
||||
200,
|
||||
path.join(__dirname, `/../src/testdata/codeql-bundle-pinned.tar.gz`)
|
||||
);
|
||||
|
||||
mockApiDetails(sampleGHAEApiDetails);
|
||||
sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
|
||||
process.env["GITHUB_ACTION_REPOSITORY"] = "github/codeql-action";
|
||||
|
||||
const result = await codeql.setupCodeQL(
|
||||
undefined,
|
||||
sampleGHAEApiDetails,
|
||||
tmpDir,
|
||||
util.GitHubVariant.GHAE,
|
||||
false,
|
||||
{
|
||||
cliVersion: defaults.cliVersion,
|
||||
tagName: defaults.bundleVersion,
|
||||
variant: util.GitHubVariant.GHAE,
|
||||
},
|
||||
getRunnerLogger(true),
|
||||
false
|
||||
);
|
||||
|
||||
t.is(result.toolsSource, ToolsSource.Download);
|
||||
t.assert(Number.isInteger(result.toolsDownloadDurationMs));
|
||||
|
||||
const cachedVersions = toolcache.findAllVersions("CodeQL");
|
||||
t.is(cachedVersions.length, 1);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
test("bundle URL from another repo is cached as 0.0.0-bundleVersion", async (t) => {
|
||||
await util.withTmpDir(async (tmpDir) => {
|
||||
setupActionsVars(tmpDir, tmpDir);
|
||||
|
||||
const bundleAssetID = 10;
|
||||
|
||||
const platform =
|
||||
process.platform === "win32"
|
||||
? "win64"
|
||||
: process.platform === "linux"
|
||||
? "linux64"
|
||||
: "osx64";
|
||||
const codeQLBundleName = `codeql-bundle-${platform}.tar.gz`;
|
||||
|
||||
nock("https://example.githubenterprise.com")
|
||||
.get(
|
||||
`/api/v3/enterprise/code-scanning/codeql-bundle/find/${defaults.bundleVersion}`
|
||||
)
|
||||
.reply(200, {
|
||||
assets: { [codeQLBundleName]: bundleAssetID },
|
||||
});
|
||||
|
||||
nock("https://example.githubenterprise.com")
|
||||
.get(
|
||||
`/api/v3/enterprise/code-scanning/codeql-bundle/download/${bundleAssetID}`
|
||||
)
|
||||
.reply(200, {
|
||||
url: `https://example.githubenterprise.com/github/codeql-action/releases/download/${defaults.bundleVersion}/${codeQLBundleName}`,
|
||||
});
|
||||
|
||||
nock("https://example.githubenterprise.com")
|
||||
.get(
|
||||
`/github/codeql-action/releases/download/${defaults.bundleVersion}/${codeQLBundleName}`
|
||||
)
|
||||
.replyWithFile(
|
||||
200,
|
||||
path.join(__dirname, `/../src/testdata/codeql-bundle-pinned.tar.gz`)
|
||||
);
|
||||
|
||||
mockApiDetails(sampleGHAEApiDetails);
|
||||
sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
|
||||
process.env["GITHUB_ACTION_REPOSITORY"] = "github/codeql-action";
|
||||
mockApiDetails(sampleApiDetails);
|
||||
sinon.stub(actionsUtil, "isRunningLocalAction").returns(true);
|
||||
const releasesApiMock = mockReleaseApi({
|
||||
assetNames: ["cli-version-2.12.2.txt"],
|
||||
tagName: "codeql-bundle-20230203",
|
||||
});
|
||||
mockDownloadApi({
|
||||
repo: "dsp-testing/codeql-cli-nightlies",
|
||||
platformSpecific: false,
|
||||
tagName: "codeql-bundle-20230203",
|
||||
});
|
||||
|
||||
const result = await codeql.setupCodeQL(
|
||||
undefined,
|
||||
sampleGHAEApiDetails,
|
||||
"https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/codeql-bundle-20230203/codeql-bundle.tar.gz",
|
||||
sampleApiDetails,
|
||||
tmpDir,
|
||||
util.GitHubVariant.GHAE,
|
||||
util.GitHubVariant.DOTCOM,
|
||||
false,
|
||||
{
|
||||
cliVersion: defaults.cliVersion,
|
||||
tagName: defaults.bundleVersion,
|
||||
variant: util.GitHubVariant.GHAE,
|
||||
},
|
||||
SAMPLE_DEFAULT_CLI_VERSION,
|
||||
getRunnerLogger(true),
|
||||
false
|
||||
);
|
||||
|
||||
t.is(result.toolsVersion, "0.0.0-20230203");
|
||||
t.is(result.toolsSource, ToolsSource.Download);
|
||||
t.assert(Number.isInteger(result.toolsDownloadDurationMs));
|
||||
t.true(Number.isInteger(result.toolsDownloadDurationMs));
|
||||
|
||||
const cachedVersions = toolcache.findAllVersions("CodeQL");
|
||||
t.is(cachedVersions.length, 1);
|
||||
t.is(cachedVersions[0], "0.0.0-20230203");
|
||||
|
||||
t.false(releasesApiMock.isDone());
|
||||
});
|
||||
});
|
||||
|
||||
|
|
|
|||
|
|
@ -241,24 +241,36 @@ async function getCodeQLBundleDownloadURL(
|
|||
return `https://github.com/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${codeQLBundleName}`;
|
||||
}
|
||||
|
||||
function getBundleVersionFromTagName(tagName: string): string {
|
||||
function tryGetBundleVersionFromTagName(
|
||||
tagName: string,
|
||||
logger: Logger
|
||||
): string | undefined {
|
||||
const match = tagName.match(/^codeql-bundle-(.*)$/);
|
||||
if (match === null || match.length < 2) {
|
||||
throw new Error(
|
||||
`Malformed bundle tag name: ${tagName}. Bundle version could not be inferred`
|
||||
);
|
||||
logger.debug(`Could not determine bundle version from tag ${tagName}.`);
|
||||
return undefined;
|
||||
}
|
||||
return match[1];
|
||||
}
|
||||
|
||||
export function getBundleVersionFromUrl(url: string): string {
|
||||
function tryGetTagNameFromUrl(url: string, logger: Logger): string | undefined {
|
||||
const match = url.match(/\/(codeql-bundle-.*)\//);
|
||||
if (match === null || match.length < 2) {
|
||||
throw new Error(
|
||||
`Malformed tools url: ${url}. Bundle version could not be inferred`
|
||||
);
|
||||
logger.debug(`Could not determine tag name for URL ${url}.`);
|
||||
return undefined;
|
||||
}
|
||||
return getBundleVersionFromTagName(match[1]);
|
||||
return match[1];
|
||||
}
|
||||
|
||||
export function tryGetBundleVersionFromUrl(
|
||||
url: string,
|
||||
logger: Logger
|
||||
): string | undefined {
|
||||
const tagName = tryGetTagNameFromUrl(url, logger);
|
||||
if (tagName === undefined) {
|
||||
return undefined;
|
||||
}
|
||||
return tryGetBundleVersionFromTagName(tagName, logger);
|
||||
}
|
||||
|
||||
export function convertToSemVer(version: string, logger: Logger): string {
|
||||
|
|
@ -291,6 +303,8 @@ type CodeQLToolsSource =
|
|||
toolsVersion: string;
|
||||
}
|
||||
| {
|
||||
/** Bundle version of the tools, if known. */
|
||||
bundleVersion?: string;
|
||||
/** CLI version of the tools, if known. */
|
||||
cliVersion?: string;
|
||||
codeqlURL: string;
|
||||
|
|
@ -299,22 +313,11 @@ type CodeQLToolsSource =
|
|||
toolsVersion: string;
|
||||
};
|
||||
|
||||
async function getOrFindBundleTagName(
|
||||
version: CodeQLDefaultVersionInfo,
|
||||
logger: Logger
|
||||
): Promise<string> {
|
||||
if (version.variant === util.GitHubVariant.DOTCOM) {
|
||||
return await findCodeQLBundleTagDotcomOnly(version.cliVersion, logger);
|
||||
} else {
|
||||
return version.tagName;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Look for a version of the CodeQL tools in the cache which could override the requested CLI version.
|
||||
*/
|
||||
async function findOverridingToolsInCache(
|
||||
requestedCliVersion: string,
|
||||
humanReadableVersion: string,
|
||||
logger: Logger
|
||||
): Promise<CodeQLToolsSource | undefined> {
|
||||
const candidates = toolcache
|
||||
|
|
@ -329,7 +332,7 @@ async function findOverridingToolsInCache(
|
|||
if (candidates.length === 1) {
|
||||
const candidate = candidates[0];
|
||||
logger.debug(
|
||||
`CodeQL tools version ${candidate.version} in toolcache overriding version ${requestedCliVersion}.`
|
||||
`CodeQL tools version ${candidate.version} in toolcache overriding version ${humanReadableVersion}.`
|
||||
);
|
||||
return {
|
||||
codeqlFolder: candidate.folder,
|
||||
|
|
@ -365,7 +368,8 @@ export async function getCodeQLSource(
|
|||
};
|
||||
}
|
||||
|
||||
const forceLatestReason =
|
||||
/** The reason why the tools shipped with the Action have been forced. */
|
||||
const forceShippedToolsReason =
|
||||
// We use the special value of 'latest' to prioritize the version in the
|
||||
// defaults over any pinned cached version.
|
||||
toolsInput === "latest"
|
||||
|
|
@ -377,64 +381,67 @@ export async function getCodeQLSource(
|
|||
toolsInput === undefined && bypassToolcache
|
||||
? "a specific version of the CodeQL tools was not requested and the bypass toolcache feature is enabled"
|
||||
: undefined;
|
||||
const forceLatest = forceLatestReason !== undefined;
|
||||
if (forceLatest) {
|
||||
logger.debug(
|
||||
`Forcing the latest version of the CodeQL tools since ${forceLatestReason}.`
|
||||
/** Whether the tools shipped with the Action, i.e. those in `defaults.json`, have been forced. */
|
||||
const forceShippedTools = forceShippedToolsReason !== undefined;
|
||||
if (forceShippedTools) {
|
||||
logger.info(
|
||||
"Overriding the version of the CodeQL tools by the version shipped with the Action since " +
|
||||
`${forceShippedToolsReason}.`
|
||||
);
|
||||
}
|
||||
|
||||
/** CLI version number, for example 2.12.1. */
|
||||
let cliVersion: string | undefined;
|
||||
/** Tag name of the CodeQL bundle, for example `codeql-bundle-20230120`. */
|
||||
let tagName: string | undefined;
|
||||
/**
|
||||
* The requested version is:
|
||||
*
|
||||
* 1. The one in `defaults.json`, if forceLatest is true.
|
||||
* 2. The version specified by the tools input URL, if one was provided.
|
||||
* 3. The default CLI version, otherwise.
|
||||
|
||||
* We include a `variant` property to let us verify using the type system that
|
||||
* `tagName` is only undefined when the variant is Dotcom. This lets us ensure
|
||||
* that we can always compute `tagName`, either by using the existing tag name
|
||||
* on enterprise instances, or calling `findCodeQLBundleTagDotcomOnly` on
|
||||
* Dotcom.
|
||||
* URL of the CodeQL bundle.
|
||||
*
|
||||
* This does not always include a tag name.
|
||||
*/
|
||||
const requestedVersion = forceLatest
|
||||
? // case 1
|
||||
{
|
||||
cliVersion: defaults.cliVersion,
|
||||
syntheticCliVersion: defaults.cliVersion,
|
||||
tagName: defaults.bundleVersion,
|
||||
variant,
|
||||
}
|
||||
: toolsInput !== undefined
|
||||
? // case 2
|
||||
{
|
||||
syntheticCliVersion: convertToSemVer(
|
||||
getBundleVersionFromUrl(toolsInput),
|
||||
logger
|
||||
),
|
||||
tagName: `codeql-bundle-${getBundleVersionFromUrl(toolsInput)}`,
|
||||
url: toolsInput,
|
||||
variant,
|
||||
}
|
||||
: // case 3
|
||||
{
|
||||
...defaultCliVersion,
|
||||
syntheticCliVersion: defaultCliVersion.cliVersion,
|
||||
};
|
||||
let url: string | undefined;
|
||||
|
||||
// If we find the specified version, we always use that.
|
||||
let codeqlFolder = toolcache.find(
|
||||
"CodeQL",
|
||||
requestedVersion.syntheticCliVersion
|
||||
if (forceShippedTools) {
|
||||
cliVersion = defaults.cliVersion;
|
||||
tagName = defaults.bundleVersion;
|
||||
} else if (toolsInput !== undefined) {
|
||||
// If a tools URL was provided, then use that.
|
||||
tagName = tryGetTagNameFromUrl(toolsInput, logger);
|
||||
url = toolsInput;
|
||||
} else {
|
||||
// Otherwise, use the default CLI version passed in.
|
||||
cliVersion = defaultCliVersion.cliVersion;
|
||||
tagName = defaultCliVersion["tagName"];
|
||||
}
|
||||
|
||||
const bundleVersion =
|
||||
tagName && tryGetBundleVersionFromTagName(tagName, logger);
|
||||
const humanReadableVersion =
|
||||
cliVersion ??
|
||||
(bundleVersion && convertToSemVer(bundleVersion, logger)) ??
|
||||
tagName ??
|
||||
url ??
|
||||
"unknown";
|
||||
|
||||
logger.debug(
|
||||
"Attempting to obtain CodeQL tools. " +
|
||||
`CLI version: ${cliVersion ?? "unknown"}, ` +
|
||||
`bundle tag name: ${tagName ?? "unknown"}, ` +
|
||||
`URL: ${url ?? "unspecified"}.`
|
||||
);
|
||||
let tagName: string | undefined = requestedVersion["tagName"];
|
||||
|
||||
if (!codeqlFolder) {
|
||||
logger.debug(
|
||||
"Didn't find a version of the CodeQL tools in the toolcache with a version number " +
|
||||
`exactly matching ${requestedVersion.syntheticCliVersion}.`
|
||||
);
|
||||
if (requestedVersion.cliVersion) {
|
||||
let codeqlFolder;
|
||||
|
||||
if (cliVersion) {
|
||||
// If we find the specified CLI version, we always use that.
|
||||
codeqlFolder = toolcache.find("CodeQL", cliVersion);
|
||||
|
||||
// Fall back to matching `x.y.z-<tagName>`.
|
||||
if (!codeqlFolder) {
|
||||
logger.debug(
|
||||
"Didn't find a version of the CodeQL tools in the toolcache with a version number " +
|
||||
`exactly matching ${cliVersion}.`
|
||||
);
|
||||
const allVersions = toolcache.findAllVersions("CodeQL");
|
||||
logger.debug(
|
||||
`Found the following versions of the CodeQL tools in the toolcache: ${JSON.stringify(
|
||||
|
|
@ -444,55 +451,82 @@ export async function getCodeQLSource(
|
|||
// If there is exactly one version of the CodeQL tools in the toolcache, and that version is
|
||||
// the form `x.y.z-<tagName>`, then use it.
|
||||
const candidateVersions = allVersions.filter((version) =>
|
||||
version.startsWith(`${requestedVersion.cliVersion}-`)
|
||||
version.startsWith(`${cliVersion}-`)
|
||||
);
|
||||
if (candidateVersions.length === 1) {
|
||||
logger.debug("Exactly one candidate version found, using that.");
|
||||
codeqlFolder = toolcache.find("CodeQL", candidateVersions[0]);
|
||||
} else {
|
||||
logger.debug(
|
||||
"Did not find exactly one version of the CodeQL tools starting with the requested version."
|
||||
`Exactly one version of the CodeQL tools starting with ${cliVersion} found in the ` +
|
||||
"toolcache, using that."
|
||||
);
|
||||
codeqlFolder = toolcache.find("CodeQL", candidateVersions[0]);
|
||||
} else if (candidateVersions.length === 0) {
|
||||
logger.debug(
|
||||
`Didn't find any versions of the CodeQL tools starting with ${cliVersion} ` +
|
||||
`in the toolcache. Trying next fallback method.`
|
||||
);
|
||||
} else {
|
||||
logger.warning(
|
||||
`Found ${candidateVersions.length} versions of the CodeQL tools starting with ` +
|
||||
`${cliVersion} in the toolcache, but at most one was expected.`
|
||||
);
|
||||
logger.debug("Trying next fallback method.");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (!codeqlFolder && requestedVersion.cliVersion) {
|
||||
// Fall back to accepting a `0.0.0-<bundleVersion>` version if we didn't find the
|
||||
// `x.y.z` version. This is to support old versions of the toolcache.
|
||||
//
|
||||
// If we are on Dotcom, we will make an HTTP request to the Releases API here
|
||||
// to find the tag name for the requested version.
|
||||
tagName =
|
||||
tagName || (await getOrFindBundleTagName(requestedVersion, logger));
|
||||
const fallbackVersion = convertToSemVer(
|
||||
getBundleVersionFromTagName(tagName),
|
||||
logger
|
||||
// Fall back to matching `0.0.0-<bundleVersion>`.
|
||||
if (!codeqlFolder && (cliVersion || tagName)) {
|
||||
if (cliVersion || tagName) {
|
||||
const fallbackVersion = await tryGetFallbackToolcacheVersion(
|
||||
cliVersion,
|
||||
tagName,
|
||||
variant,
|
||||
logger
|
||||
);
|
||||
if (fallbackVersion) {
|
||||
codeqlFolder = toolcache.find("CodeQL", fallbackVersion);
|
||||
} else {
|
||||
logger.debug(
|
||||
"Could not determine a fallback toolcache version number for CodeQL tools version " +
|
||||
`${humanReadableVersion}.`
|
||||
);
|
||||
}
|
||||
} else {
|
||||
logger.debug(
|
||||
"Both the CLI version and the bundle version are unknown, so we will not be able to find " +
|
||||
"the requested version of the CodeQL tools in the toolcache."
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
if (codeqlFolder) {
|
||||
logger.info(
|
||||
`Found CodeQL tools version ${humanReadableVersion} in the toolcache.`
|
||||
);
|
||||
logger.debug(
|
||||
`Computed a fallback toolcache version number of ${fallbackVersion} for CodeQL tools version ` +
|
||||
`${requestedVersion.cliVersion}.`
|
||||
} else {
|
||||
logger.info(
|
||||
`Did not find CodeQL tools version ${humanReadableVersion} in the toolcache.`
|
||||
);
|
||||
codeqlFolder = toolcache.find("CodeQL", fallbackVersion);
|
||||
}
|
||||
|
||||
if (codeqlFolder) {
|
||||
return {
|
||||
codeqlFolder,
|
||||
sourceType: "toolcache",
|
||||
toolsVersion: requestedVersion.syntheticCliVersion,
|
||||
toolsVersion: cliVersion ?? humanReadableVersion,
|
||||
};
|
||||
}
|
||||
logger.debug(
|
||||
`Did not find CodeQL tools version ${requestedVersion.syntheticCliVersion} in the toolcache.`
|
||||
);
|
||||
|
||||
// If we don't find the requested version on Enterprise, we may allow a
|
||||
// different version to save download time if the version hasn't been
|
||||
// specified explicitly (in which case we always honor it).
|
||||
if (variant !== util.GitHubVariant.DOTCOM && !forceLatest && !toolsInput) {
|
||||
if (
|
||||
variant !== util.GitHubVariant.DOTCOM &&
|
||||
!forceShippedTools &&
|
||||
!toolsInput
|
||||
) {
|
||||
const result = await findOverridingToolsInCache(
|
||||
requestedVersion.syntheticCliVersion,
|
||||
humanReadableVersion,
|
||||
logger
|
||||
);
|
||||
if (result !== undefined) {
|
||||
|
|
@ -500,30 +534,66 @@ export async function getCodeQLSource(
|
|||
}
|
||||
}
|
||||
|
||||
if (!url) {
|
||||
if (!tagName && cliVersion && variant === util.GitHubVariant.DOTCOM) {
|
||||
tagName = await findCodeQLBundleTagDotcomOnly(cliVersion, logger);
|
||||
} else if (!tagName) {
|
||||
throw new Error(
|
||||
`Could not obtain the requested version (${humanReadableVersion}) of the CodeQL tools ` +
|
||||
"since we could not compute the tag name."
|
||||
);
|
||||
}
|
||||
url = await getCodeQLBundleDownloadURL(
|
||||
tagName,
|
||||
apiDetails,
|
||||
variant,
|
||||
logger
|
||||
);
|
||||
}
|
||||
|
||||
return {
|
||||
cliVersion: requestedVersion.cliVersion || undefined,
|
||||
codeqlURL:
|
||||
requestedVersion["url"] ||
|
||||
(await getCodeQLBundleDownloadURL(
|
||||
tagName ||
|
||||
// The check on `requestedVersion.tagName` is redundant but lets us
|
||||
// use the property that if we don't know `requestedVersion.tagName`,
|
||||
// then we must know `requestedVersion.cliVersion`. This property is
|
||||
// required by the type of `getOrFindBundleTagName`.
|
||||
(requestedVersion.tagName !== undefined
|
||||
? requestedVersion.tagName
|
||||
: await getOrFindBundleTagName(requestedVersion, logger)),
|
||||
apiDetails,
|
||||
variant,
|
||||
logger
|
||||
)),
|
||||
bundleVersion: tagName && tryGetBundleVersionFromTagName(tagName, logger),
|
||||
cliVersion,
|
||||
codeqlURL: url,
|
||||
sourceType: "download",
|
||||
toolsVersion: requestedVersion.syntheticCliVersion,
|
||||
toolsVersion: cliVersion ?? humanReadableVersion,
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets a fallback version number to use when looking for CodeQL in the toolcache if we didn't find
|
||||
* the `x.y.z` version. This is to support old versions of the toolcache.
|
||||
*/
|
||||
export async function tryGetFallbackToolcacheVersion(
|
||||
cliVersion: string | undefined,
|
||||
tagName: string | undefined,
|
||||
variant: util.GitHubVariant,
|
||||
logger: Logger
|
||||
): Promise<string | undefined> {
|
||||
//
|
||||
// If we are on Dotcom, we will make an HTTP request to the Releases API here
|
||||
// to find the tag name for the requested version.
|
||||
if (cliVersion && !tagName && variant === util.GitHubVariant.DOTCOM) {
|
||||
tagName = await findCodeQLBundleTagDotcomOnly(cliVersion, logger);
|
||||
}
|
||||
if (!tagName) {
|
||||
return undefined;
|
||||
}
|
||||
const bundleVersion = tryGetBundleVersionFromTagName(tagName, logger);
|
||||
if (!bundleVersion) {
|
||||
return undefined;
|
||||
}
|
||||
const fallbackVersion = convertToSemVer(bundleVersion, logger);
|
||||
logger.debug(
|
||||
`Computed a fallback toolcache version number of ${fallbackVersion} for CodeQL version ` +
|
||||
`${cliVersion ?? tagName}.`
|
||||
);
|
||||
return fallbackVersion;
|
||||
}
|
||||
|
||||
export async function downloadCodeQL(
|
||||
codeqlURL: string,
|
||||
maybeBundleVersion: string | undefined,
|
||||
maybeCliVersion: string | undefined,
|
||||
apiDetails: api.GitHubApiDetails,
|
||||
variant: util.GitHubVariant,
|
||||
|
|
@ -543,11 +613,12 @@ export async function downloadCodeQL(
|
|||
// from the same GitHub instance the Action is running on.
|
||||
// This avoids leaking Enterprise tokens to dotcom.
|
||||
// We also don't want to send an authorization header if there's already a token provided in the URL.
|
||||
let authorization: string | undefined = undefined;
|
||||
if (searchParams.has("token")) {
|
||||
logger.debug("CodeQL tools URL contains an authorization token.");
|
||||
} else if (codeqlURL.startsWith(`${apiDetails.url}/`)) {
|
||||
logger.debug("Providing an authorization token to download CodeQL tools.");
|
||||
headers.authorization = `token ${apiDetails.auth}`;
|
||||
authorization = `token ${apiDetails.auth}`;
|
||||
} else {
|
||||
logger.debug("Downloading CodeQL tools without an authorization token.");
|
||||
}
|
||||
|
|
@ -565,7 +636,7 @@ export async function downloadCodeQL(
|
|||
const codeqlPath = await toolcache.downloadTool(
|
||||
codeqlURL,
|
||||
dest,
|
||||
undefined,
|
||||
authorization,
|
||||
finalHeaders
|
||||
);
|
||||
const toolsDownloadDurationMs = Math.round(
|
||||
|
|
@ -576,16 +647,33 @@ export async function downloadCodeQL(
|
|||
|
||||
const codeqlExtracted = await toolcache.extractTar(codeqlPath);
|
||||
|
||||
const bundleVersion = getBundleVersionFromUrl(codeqlURL);
|
||||
const bundleVersion =
|
||||
maybeBundleVersion ?? tryGetBundleVersionFromUrl(codeqlURL, logger);
|
||||
|
||||
if (bundleVersion === undefined) {
|
||||
logger.debug(
|
||||
"Could not cache CodeQL tools because we could not determine the bundle version from the " +
|
||||
`URL ${codeqlURL}.`
|
||||
);
|
||||
return {
|
||||
toolsVersion: maybeCliVersion ?? "unknown",
|
||||
codeqlFolder: codeqlExtracted,
|
||||
toolsDownloadDurationMs,
|
||||
};
|
||||
}
|
||||
|
||||
// Try to compute the CLI version for this bundle
|
||||
const cliVersion: string | undefined =
|
||||
maybeCliVersion ||
|
||||
(variant === util.GitHubVariant.DOTCOM &&
|
||||
(await tryFindCliVersionDotcomOnly(
|
||||
`codeql-bundle-${bundleVersion}`,
|
||||
logger
|
||||
))) ||
|
||||
undefined;
|
||||
if (
|
||||
maybeCliVersion === undefined &&
|
||||
variant === util.GitHubVariant.DOTCOM &&
|
||||
codeqlURL.includes(`/${CODEQL_DEFAULT_ACTION_REPOSITORY}/`)
|
||||
) {
|
||||
maybeCliVersion = await tryFindCliVersionDotcomOnly(
|
||||
`codeql-bundle-${bundleVersion}`,
|
||||
logger
|
||||
);
|
||||
}
|
||||
|
||||
// Include both the CLI version and the bundle version in the toolcache version number. That way
|
||||
// if the user requests the same URL again, we can get it from the cache without having to call
|
||||
// any of the Releases API.
|
||||
|
|
@ -595,12 +683,11 @@ export async function downloadCodeQL(
|
|||
// CLI release. In principle, it should be enough to just check that the CLI version isn't a
|
||||
// pre-release, but the version numbers of CodeQL nightlies have the format `x.y.z+<timestamp>`,
|
||||
// and we don't want these nightlies to override stable CLI versions in the toolcache.
|
||||
const toolcacheVersion =
|
||||
cliVersion && cliVersion.match(/^[0-9]+\.[0-9]+\.[0-9]+$/)
|
||||
? `${cliVersion}-${bundleVersion}`
|
||||
: convertToSemVer(bundleVersion, logger);
|
||||
const toolcacheVersion = maybeCliVersion?.match(/^[0-9]+\.[0-9]+\.[0-9]+$/)
|
||||
? `${maybeCliVersion}-${bundleVersion}`
|
||||
: convertToSemVer(bundleVersion, logger);
|
||||
return {
|
||||
toolsVersion: cliVersion || toolcacheVersion,
|
||||
toolsVersion: maybeCliVersion ?? toolcacheVersion,
|
||||
codeqlFolder: await toolcache.cacheDir(
|
||||
codeqlExtracted,
|
||||
"CodeQL",
|
||||
|
|
@ -674,6 +761,7 @@ export async function setupCodeQLBundle(
|
|||
case "download": {
|
||||
const result = await downloadCodeQL(
|
||||
source.codeqlURL,
|
||||
source.bundleVersion,
|
||||
source.cliVersion,
|
||||
apiDetails,
|
||||
variant,
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue